KI
Vendor security profile
Kong Inc.
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs7
Critical0
CISA KEV0
Public exploit0
Patch rate%100
Avg. CVSS5.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
7
0
0
CVE KEV
CVE severity distribution
7toplam CVE
High1 (14%)
Medium6 (86%)
Patch and exploitation view
%100
Verified patch
%0
CISA KEV
%0
Public exploit
7Patch available
0Partial
0Workaround
0Vendor: no patch
0Unknown
Latest vulnerabilities
7.0
CVE-2026-18674
Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier
KI
Patch verifiedEPSS %1
5.8
CVE-2026-18679
Kong Mesh: kuma-dp connects to the control plane without verifying the TLS certificate when no CA is configured
KI
Patch verifiedEPSS %0
5.5
CVE-2026-18678
Kong Mesh: kumactl connects to the control plane without verifying the TLS certificate when no CA is configured
KI
Patch verifiedEPSS %0
6.0
CVE-2026-18677
Kong Mesh: a dataplane token without a workload binding can claim any workload's SPIFFE identity
KI
Patch verifiedEPSS %0
5.1
CVE-2026-18676
Kong Mesh: default control plane config leaks the admin token cross-origin via a CORS wildcard and localhost admin
KI
Patch verifiedEPSS %0
5.3
CVE-2026-18675
Kong Mesh: control plane denial of service via a malformed dataplane token with a non-string JWT kid
KI
Patch verifiedEPSS %1
5.3
CVE-2026-18673
Kong Mesh: the kuma-dp readiness service exposes the Envoy admin API without authentication
KI
Patch verifiedEPSS %0